Browse public community intelligence reports, source analysis, and threat research.
25 intel reports
TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
The Miasma threat actor compromised 56 npm packages to steal CI/CD secrets and deploy persistent backdoors using a novel binding.gyp execution trigger.
The Mini Shai-Hulud worm was deployed via compromised @antv npm packages to exfiltrate developer secrets and propagate to other repositories.
The Kyber ransomware group deploys specialized dual-platform payloads targeting VMware ESXi infrastructure and Windows file systems, utilizing hybrid encryption and extensive anti-recovery techniques.
